NetworkBoundaries Object
Relationships
graph LR
NetworkBoundaries -->|"account"| Accounts
NetworkBoundaries -->|"attached_rule_sets"| FirewallRuleSets
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Firewall rule sets attached at the boundary level.
The target's id.
Whether a boundary-wide public-access block overrides routing. A boundary can have an internet gateway route and still be unreachable because of this.
The provider's own identifier for the network.
The address ranges the network covers.
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
How long the provider batches records before writing them — a batching window, not a sampling fraction. Not the same as flow_log_sampling_rate.
What fraction of traffic is captured, where the provider samples. Null with not_supported_by_provider on AWS, which has no sampling rate field or setting.
Whether flow logging is on for this boundary. Flow logs can attach at boundary, subnet, or interface level; true requires the log to be ACTIVE and actually delivering, not just present.
Whether the boundary can reach the internet, accounting for subnets implicitly associated with the main route table (not just explicit associations).
What kind of internet path exists — an internet gateway (inbound-capable) is a different finding from outbound-only NAT, and the two are kept distinct.
noneinternet_gatewaynat_onlyipv6_egress_onlyunknown
True where the provider's network has no location at all. When true, the envelope region carries the literal string 'global' rather than a guessed region.
Whether this is the provider's automatically created default network.
The network name.
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
Which cloud this object was read from.
awsazuregcp
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
Whether the network is regional or genuinely global.
regionalglobal
Subnets inside this boundary. Nested because a subnet is only meaningful within its boundary.
The zone the subnet sits in.
The address range of the subnet.
Whether instances launched here get a public IP automatically.
The subnet's provider reference.
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.